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LI 


2 


"6412071".pn. 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 16:58 


S5 


0 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(("windows hooks" or "os hooks") and 
(malware or virus or viruses or trojan? 
or worm? or commandeer$ or attack$ 
or compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(buffer$ or stack$)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:11 


S7 


1 


("7097$xcls. or "380"/$.ccls. or 
"713"/$.ccls. or "7267$.ccls.) and 
(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and (malware 
or virus or viruses or trojan? or worm? 
or commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(buffer$ or stack$)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/02/27 16:30 


S8 


1 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and (malware 
or virus or viruses or trojan? or worm? 
or commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(call or "api" or buffer$ or stack$)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/02/27 16:33 


S9 


6 


(((unix or linux or window$ or "os") 
adj2 (hook? or stall$)) and (malware 
or virus or viruses or trojan? or worm? 
or commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(call or "api" or buffer$ or stack$)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/02/27 16:32 


S10 


20 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "726"/$.cds.) and 
(((unix or linux or window$ or "os" or 
"operating system") adj2 (hook? or 
stall$ or intercept? or interdict$ or 
captur$)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(call or "api" or buffer$ or stack$)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM.TDB 


OR 


OFF 


2007/02/27 16:50 



3/6/07 5:23:28 PM 

C:\Documents and Settings\RBaum\My Documents\EAST\workspaces\10671202.wsp 
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S15 


144 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((unix or linux or window$ or "os" or 
"operating system" or Solaris or "os9") 
same (event or exception or hook? or 
stall$ or intercept? or interdict$ or 
captur$)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" or 
buffer$ or stack$ or application?)) and 
dispatch$ and @ad<"20030925" 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/01 14:25 


S16 


388 


(((unix or linux or window$ or "os" or 
"operating system" or Solaris or "os9") 
same (event or exception or hook? or 
sta|l$ or intercept? or interdict$ or 
captur$)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" or 
buffer$ or stack$ or application?)) and 
dispatch$ and @ad<"20030925" 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/01 14:30 


S17 


141 


(((unix or linux or window$ or "os" or 
"operating system" or Solaris or "os9") 
same (event or exception or hook? or 
stall$ or intercept? or interdict$ or 
captur$)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$) with 
(thread? or process or call or "api" or 
buffer$ or stack$ or application?)) and 
dispatch$ and handler? and 
@ad<"20030925" 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/01 14:30 


S18 


0 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) adjl 
hook?)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or 
"libc") and (frame$ or buffer$ or 
stack$) and (("ret" or return) adj2 
(instruction? or command or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:18 



3/6/07 5:23:28 PM 
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S19 


59 


("709"/$.ccls. or "3807$.ccls. or 
"713"/$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) with 
hook?)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or 
"libc") and (frame$ or buffer$ or 
stack$) and (("ret" or return) with 
(instruction? or command or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:21 


S20 


61 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "7267$.ccls.) and 
(((window? or "os" or operating) with 
hook?)) and (malware or virus or 
viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or "libc" 
or intrusion or "ids") and (frame$ or 
buffer$ or stack$) and (("ret" or 
return) with (instruction? or command 
or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:22 


S21 


67 


("709"/$.ccls. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) with 
hook?)) and (security or malware or 
virus or viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or "libc" 
or intrusion or "ids") and (frame$ or 
buffer$ or stack$) and (("ret" or 
return) with (instruction? or command 
or function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:30 


S22 


68 


("709"/$.ccls. or "380"/$.ccls. or 
"713"/$.ccls. or "726"/$.cds.) and 
(((window? or "os" or operating) with 
hook?)) and (security or malware or 
virus or viruses or trojan? or worm? or 
commandeer$ or attack$ or 
compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or "libc" 
or intrusion or "ids") and (frame$ or 
buffer$ or stack$) and (("ret" or 
return) with (exception? or interrupt$ 
or instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:48 
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S23 


68 


("709"/$.cds. or "380"/$.ccls. or 
"7137$.ccls. or "726"/$.ccls.) and 
(((window? or "os" or operating) with 
hook?)) and (hijack$ or risk or security 
or malware or virus or viruses or 
trojan? or worm? or commandeer$ or 
attack$ or compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or libc 
or intrusion or "ids") and (frame$ or 
buffer$ or stack$) and (("ret" or 
return) with (exception? or interrupt$ 
or instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 11:50 


S24 


147 


(((window? or "os" or operating) with 
hook?)) and (hijack$ or risk or security 
or malware or virus or viruses or 
trojan? or worm? or commandeer$ or 
attack$ or compromis$ or corrupt$ or 
countermeasur$ or overfllow$ or "libc" 
or intrusion or "ids") and (frame$ or 
buffer$ or stack$) and (("ret" or . 
return) with (exception? or interrupt$ 
or instruction? or command or 
function)) 


US-PGPUB; 
USPAT; 
EPO; JPO; 
DERWENT; 
IBM_TDB 


OR 


OFF 


2007/03/06 16:58 
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